California AG endorses bill expanding consumer privacy protections

SAN FRANCISCO (Reuters) – California Attorney General Xavier Becerra on Monday endorsed a state bill that would expand the state’s new privacy act to allow consumers to sue companies over their handling of personal data, despite months of tech lobbying against such a move.

California’s data privacy law, passed last year, imposes fines of up to $7,500 on large companies for intentional failure to disclose data collection or delete user data on request, or for selling others’ data without permission.

Under the law, set to take effect next year, consumers may file complaints to the attorney general over alleged violations but can sue only in the case of a data breach. The new bill, introduced in the state legislature on Friday, would enable them to sue over any alleged violations.

“As written, the law gives California consumers new rights but denies them the ability to… defend themselves in court,” Becerra said at a joint press conference with California Senator Hannah-Beth Jackson, who authored the bill.

Several tech lobbying groups have told Reuters that allowing wide-ranging consumer privacy lawsuits is among the few legislative proposals the industry will staunchly fight in Sacramento and Washington.

The California Chamber of Commerce has said even the current privacy act “will lead to a barrage of shakedown lawsuits, as companies facing such substantial liability will be leveraged into immediate settlement, regardless of the strength of their legal defense.”

Friday’s bill would also remove a provision in the act giving businesses time to “cure” alleged violations within 30 days without penalty.

In addition, businesses would no longer be entitled to seek the opinion of the California attorney general on whether they are in compliance with the law. Instead, the attorney general’s office would publish general guidance on how to comply.

“We do not give out free legal advice… paid for by taxpayers,” said Becerra.

Many business groups are pushing for a national privacy law that would supersede state legislation before the California Consumer Privacy Act takes effect on Jan. 1, 2020.